菜单
Review code for security vulnerabilities aligned with OWASP Top 10:2025. Use when asked to audit, review, or check code for security issues including SQL injection, path traversal, authentication flaws, broken access control, and cryptographic failures in Go backend or React frontend code.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Update project documentation after implementing a feature. Use when: updating docs, documentation, update docs after implementation, sync docs with code.
Extract and formalize domain terminology into a glossary. Use when: defining domain terms, building a glossary, hardening terminology, domain model, DDD, ubiquitous language, glossary.
Generate a structured spec from direct input. Use when: you already know what you want and just need the formatted template. For exploration and interviews, use the spec-writer agent instead.
Generate unit tests from a spec's acceptance criteria. Use when: you have a written spec and need tests, generate tests from spec, TDD from spec, spec to tests.
Scaffold a new Go service package following Bookaneer's architecture. Use when creating a new domain service, adding a new integration (metadata provider, download client, indexer, notification channel), or adding a new API handler. Generates code following the project's layered architecture, interface patterns, and conventions.
| name | security-review |
| description | Review code for security vulnerabilities aligned with OWASP Top 10:2025. Use when asked to audit, review, or check code for security issues including SQL injection, path traversal, authentication flaws, broken access control, and cryptographic failures in Go backend or React frontend code. |
For each file/change, verify against these categories:
A01 — Broken Access Control
A02 — Security Misconfiguration
A03 — Supply Chain
A04 — Cryptographic Failures
crypto/rand not math/randA05 — Injection
? placeholders)exec.Commandfilepath.Clean() + prefix validationdangerouslySetInnerHTML, metadata sanitizedencoding/xml marshaling, no string concatenationA07 — Authentication Failures
A09 — Logging Failures
A10 — Exception Handling
context.Context propagated through all layersdefer)io.LimitReader used for request bodiesFor each finding:
**[SEVERITY]** Brief title
- File: path/to/file.go:42
- Issue: Description of the vulnerability
- Impact: What an attacker could achieve
- Fix: Specific code change recommended
Severities: CRITICAL, HIGH, MEDIUM, LOW, INFO